Skip to main content
Three realities of BACEN’s file hub shape Lerian STA. Per-institution credentials expire, each outbound transfer has a bounded lifetime, and BACEN does not make the protocol-create step idempotent. Lerian STA manages each one under its selected tenancy mode. It reconciles at the grain of the BACEN protocol number.

​
Pollers

When SCHEDULER_ENABLED is true, the scheduler runs a status poller on a roughly one-minute resync. Outbound status polling self-enqueues with a state-keyed backoff. Lerian STA holds all credentials of one institution to one budget of 10 simultaneous file transfers and 10 commands per minute, which password rotation shares. It reserves 20 queries per minute for inbound discovery by default.

​
Credentials

Each credential is a BACEN operator password. Lerian STA identifies it by institution code and operator ID. Lerian STA stores it encrypted with envelope encryption. Operators can create, update, test connectivity for, rotate, and revoke a credential. An update changes only the operator ID or the description.

​
Password rotation

Rotation is a three-phase protocol that keeps the old and the new password until BACEN confirms one of them:
  1. Stage the new password locally.
  2. Change it at BACEN.
  3. Promote it locally.
A recovery sweep resolves rotations left in flight. It runs once at worker boot when CREDENTIALS_RECOVERY_ON_BOOT is true, and on each credential sweep when SCHEDULER_ENABLED is true. If BACEN accepts neither the old nor the new password, Lerian STA locks the credential in an error state for a manual credential reset.

​
Password-expiry monitoring

BACEN enforces periodic password changes. Lerian STA tracks each credential’s BACEN-reported expiry through a read-through cache. It projects a health band with the days remaining. The bands are healthy above 15 days, warning from 6 to 15, critical from 1 to 5, and expired at 0 or below. An operator can then rotate the password before BACEN locks the operator out.

​
Retention and protocol TTL

  • Outbound protocol TTL. Each outbound transfer has a wall-clock lifetime, counted from when BACEN assigns its protocol. The default is 44 hours (TRANSFER_TTL_HOURS).
  • Canceled and inconsistent transfers. When SCHEDULER_ENABLED is true, Lerian STA deletes them once their last state change is more than 7 days old (SCHEDULER_QUARANTINE_RETENTION_DAYS).
  • Inbound retention. A lifecycle policy on the bucket controls how long inbound files stay.

​
Reconciliation and contingency

Lerian STA reconciles at the grain of one transfer per BACEN protocol number. On discovery, the protocol number is the idempotency key: a protocol already on record creates no second transfer. BACEN offers no idempotent protocol-create. A second create would duplicate the file at BACEN. When a create call ends with no confirmed protocol number (a timeout, an error, or a crash), Lerian STA parks the transfer in the local-only state Protocol create unconfirmed. An operator must resolve it. Lerian STA does not retry the create.